I've been googling for how to search in Splunk to find cases where two fields are not equal to each other.
The consensus is to do it like this:
index="*" source="*.csv" | where Requester!="Requested For"
However, this does not work!
This returns results where both Requester and Requested For are equal to "Bob Smith."
Why not do:
index=* source=*.csv Requester=* NOT Requester="Requested For"
This ensures there is a Requester field present, and that it is not equal to "Requested For"
If your field name contains a space, then enclose it in single quotes, not double quotes
index="*" source="*.csv" | where Requester!='Requested For'
Field Names
Field names that contain anything other than a-z, A-Z, 0-9, or the underscore ( _ ) character must be enclosed in single quotation marks ( ' ).
Related
Database I'm using: https://uploadfiles.io/72wph
select acnum, field.fieldnum, title, descrip
from field, interest
where field.fieldnum=interest.fieldnum and trim(ID) like 'B.1._';
What will the output be from the above query?
Does trim(ID) like 'B.1._' mean that it will only select items from B.1._ column?
trim removes spaces at the beginning and end.
"_" would allow representing any character. Hence query select any row that starts with "B.1."
For eg.
'B.1.0'
'B.1.9'
'B.1.A'
'B.1.Z'
etc
Optional Wildcard characters allowed in like are % (percent) and _ (underscore).
A % matches any string with zero or more characters.
An _ matches any single character.
I don't know about the DB you are using but trim usually remove spaces around the argument you give to it.
The ID is trimmed to be sure to compare the ID without any white-space around it.
About your second question, Only the ROWS with an ID like 'B.1.' will be selected.
SQL like
SQL WHERE
I can guesss it may be easy to answer type question but I am facing it first time, so any help will be more appreciated.
My Query:
SELECT remarks FROM enroll WHERE remarks LIKE 'REC_%'
OUTPUT:
remarks
REC_59161
Reclassify Hedge
Expected Output is only REC_59161. Yes _ is used for matching any single character but I am just looking for achieving my expected output.
_ is a wildcard Character. So that you have to escape it using [].
Query
select remarks
from enroll
where remarks like 'REC[_]%';
The underscore _ character is actually a special character with the LIKE operator, as are %, [] and ^:
https://learn.microsoft.com/en-us/sql/t-sql/language-elements/like-transact-sql
In that article, you'll see that an underscore _ matches any single character.
Use the ESCAPE keyword to define an escape character to allow you to escape the pattern-matching characters. We can use ! as the escape character, so:
WHERE remarks LIKE 'REC!_%' ESCAPE '!'
_ is a wildcard character, Try this :
declare #enroll table (remarks varchar(50));
insert into #enroll values ('REC_59161') , ('Reclassify Hedge');
SELECT remarks FROM #enroll WHERE remarks LIKE 'REC[_]%';
Demo
There are two issues:
It seems that the column is case insensitive, see Is the LIKE operator case-sensitive with MS SQL server? for details. That's why Rec in Reclassify Hedge fits REC in the Like
_ (as well as %) is a wild card, you should escape _ in the pattern
Query:
SELECT remarks
FROM enroll
WHERE remarks LIKE 'REC*_%' ESCAPE '*' /* SQL 92 standard */
http://www.contrib.andrew.cmu.edu/~shadow/sql/sql1992.txt
uses the triadic operator LIKE (or the inverse, NOT
LIKE), operating on three character strings and returning a Boolean.
LIKE determines whether or not a character string "matches" a given
"pattern" (also a character string). The characters '%' (percent)
and '_' (underscore) have special meaning when they occur in the
pattern. The optional third argument is a character string
containing exactly one character, known as the "escape character", for
use when a percent or underscore is required in the pattern without
its special meaning.
what is difference between these two sql statements
1- select * from tblperson where name not like '[^AKG]%';
2- select * from tblperson where name like '[AKG]%';
showing same results: letter starting from a,k,g
like '[^AKG]% -- This gets you rows where the first character of name is not A,K or G. ^ matches any single character not in the specified set or a specified range of characters. There is one more negation not. So when you say name not like '[^AKG]%' you get rows where the first character of name is A,K or G.
name like '[AKG]% -- you get rows where the first character of name is A,K or G.
The wildcard character [] matches any character in a specified range or a set of characters. In your case it is a set of characters.
So both the conditions are equivalent.
You are using a double 'NOT'. The carrot '^' in your first character match is shorthand for 'not', so you are evaluating 'not like [not' AKG]% IE not like '[^AKG]%'.
1)In the first query you are using 'Not' and '^' basically it is Not twice so it cancels outs
therefore your query is 'Not Like [^AKG]' ==> 'Like [AKG]'
^ a.k.a caret or up arrow.
The purpose of this symbol is to provide a match for any characters not listed within the brackets [] , meaning that normally it wouldn't provide a result for anything that starts with AKG, but since you added the word NOT to the query , you are basically cancelling the operator, just as if you were doing in math :
(- 1) * (- 1)
I have a query (sql) to pull out a street name from a string. It's looking for the last occurrence of a digit, and then pulling the proceeding text as the street name. I keep getting the oracle
"argument '0' is out of range"
error but I'm struggling to figure out how to fix it.
the part of the query in question is
substr(address,regexp_instr(address,'[[:digit:]]',1,regexp_count(address,'[[:digit:]]'))+2)
any help would be amazing. (using sql developer)
The fourth parameter of regexp_instr is the occurrence:
occurrence is a positive integer indicating which occurrence of
pattern in source_string Oracle should search for. The default is 1,
meaning that Oracle searches for the first occurrence of pattern.
In this case, if an address has no digits within, the regexp_count will return 0, that's not a valid occurrence.
A simpler solution, which does not require separate treatment for addresses without a house number, is this:
with t (address) as (
select '422 Hickory Str.' from dual union all
select 'One US Bank Plaza' from dual
)
select regexp_substr(address, '\s*([^0-9]*)$', 1, 1, null, 1) as street from t;
The output looks like this:
STREET
-------------------------
Hickory Str.
One US Bank Plaza
The third argument to regexp_substr is the first of the three 1's. It means start the search at the first character of address. The second 1 means find the first occurrence of the search pattern. The null means no special match modifiers (such as case insensitive - nothing like that needed here). The last 1 means "return the first SUBEXPRESSION from the match pattern". Subexpressions are parts of the match expression enclosed in parentheses.
The match pattern has a $ at the end - meaning "anchor at the end of the input string" ($ means the end of the string). Then [...] means match any of the characters in square brackets, but the ^ in [^...] changes it to match any character OTHER THAN what is in the square brackets. 0-9 means all characters between 0 and 9; so [^0-9] means match any character(s) OTHER THAN digits, and the * after that means "any number of such characters" (between 0 and everything in the input string). \s is "blank space" - if there are any blank spaces following a possible number in the address, you don't want them included right at the beginning of the street name. The subexpression is just [^0-9]* meaning the non-digits, not including any spaces before them (because the \s* is outside the left parenthesis).
My example illustrates a potential problem though - sometimes an address does, in fact, have a "number" in it, but spelled out as a word instead of using digits. What I show is in fact a real-life address in my town.
Good luck!
looking for the last occurrence of a digit, and then pulling the proceeding text as the street name
You could simply do:
SELECT REGEXP_REPLACE( address, '^(.*)\d+\D*$', '\1' )
AS street_name
FROM address_table;
What is the complete list of all special characters for a SQL (I'm interested in SQL Server but other's would be good too) LIKE clause?
E.g.
SELECT Name FROM Person WHERE Name LIKE '%Jon%'
SQL Server:
%
_
[specifier] E.g. [a-z]
[^specifier]
ESCAPE clause E.g. %30!%%' ESCAPE '!' will evaluate 30% as true
' characters need to be escaped with ' E.g. they're becomes they''re
MySQL:
% - Any string of zero or more characters.
_ - Any single character
ESCAPE clause E.g. %30!%%' ESCAPE '!' will evaluate 30% as true
Oracle:
% - Any string of zero or more characters.
_ - Any single character
ESCAPE clause E.g. %30!%%' ESCAPE '!' will evaluate 30% as true
Sybase
%
_
[specifier] E.g. [a-z]
[^specifier]
Progress:
% - Any string of zero or more characters.
_ - Any single character
Reference Guide here [PDF]
PostgreSQL:
% - Any string of zero or more characters.
_ - Any single character
ESCAPE clause E.g. %30!%%' ESCAPE '!' will evaluate 30% as true
ANSI SQL92:
%
_
An ESCAPE character only if specified.
PostgreSQL also has the SIMILAR TO operator which adds the following:
[specifier]
[^specifier]
| - either of two alternatives
* - repetition of the previous item zero or more times.
+ - repetition of the previous item one or more times.
() - group items together
The idea is to make this a community Wiki that can become a "One stop shop" for this.
For SQL Server, from http://msdn.microsoft.com/en-us/library/ms179859.aspx :
% Any string of zero or more characters.
WHERE title LIKE '%computer%' finds all book titles with the word 'computer' anywhere in the book title.
_ Any single character.
WHERE au_fname LIKE '_ean' finds all four-letter first names that end with ean (Dean, Sean, and so on).
[ ] Any single character within the specified range ([a-f]) or set ([abcdef]).
WHERE au_lname LIKE '[C-P]arsen' finds author last names ending with arsen and starting with any single character between C and P, for example Carsen, Larsen, Karsen, and so on. In range searches, the characters included in the range may vary depending on the sorting rules of the collation.
[^] Any single character not within the specified range ([^a-f]) or set ([^abcdef]).
WHERE au_lname LIKE 'de[^l]%' all author last names starting with de and where the following letter is not l.
ANSI SQL92:
%
_
an ESCAPE character only if specified.
It is disappointing that many databases do not stick to the standard rules and add extra characters, or incorrectly enable ESCAPE with a default value of ‘\’ when it is missing. Like we don't already have enough trouble with ‘\’!
It's impossible to write DBMS-independent code here, because you don't know what characters you're going to have to escape, and the standard says you can't escape things that don't need to be escaped. (See section 8.5/General Rules/3.a.ii.)
Thank you SQL! gnnn
You should add that you have to add an extra ' to escape an exising ' in SQL Server:
smith's -> smith''s
Sybase :
% : Matches any string of zero or more characters.
_ : Matches a single character.
[specifier] : Brackets enclose ranges or sets, such as [a-f]
or [abcdef].Specifier can take two forms:
rangespec1-rangespec2:
rangespec1 indicates the start of a range of characters.
- is a special character, indicating a range.
rangespec2 indicates the end of a range of characters.
set:
can be composed of any discrete set of values, in any
order, such as [a2bR].The range [a-f], and the
sets [abcdef] and [fcbdae] return the same
set of values.
Specifiers are case-sensitive.
[^specifier] : A caret (^) preceding a specifier indicates
non-inclusion. [^a-f] means "not in the range
a-f"; [^a2bR] means "not a, 2, b, or R."
Potential answer for SQL Server
Interesting I just ran a test using LinqPad with SQL Server which should be just running Linq to SQL underneath and it generates the following SQL statement.
Records
.Where(r => r.Name.Contains("lkjwer--_~[]"))
-- Region Parameters
DECLARE #p0 VarChar(1000) = '%lkjwer--~_~~~[]%'
-- EndRegion
SELECT [t0].[ID], [t0].[Name]
FROM [RECORDS] AS [t0]
WHERE [t0].[Name] LIKE #p0 ESCAPE '~'
So I haven't tested it yet but it looks like potentially the ESCAPE '~' keyword may allow for automatic escaping of a string for use within a like expression.